🛠️ Fuzzing confused dependencies with Depfuzzer
New tool designed to automate the detection of dependency confusion vulnerabilities
Repo: https://t.co/gtVsHXtoGV
By @Synacktiv
https://t.co/rQp3jjvhxH
🦀 Eliminating Memory Safety Vulnerabilities at the Source
Rust caused memory safety vulnerabilities % in Android to drop from 76% to 24% over 6 years.
💡Key insight: new code is disproportionately responsible for bugs
By @jeffvanderstoep, @ayper
https://t.co/eIpfwDXm7U
I had a great time meeting the @OwaspSAMM Community. Lots of like-minded people!
TIL: OWASP SAMM is for people running an #AppSec program. Target groups are not Developers or Security Champions. Hence OWASP DSOMM and Security Belts need to be there to support these target groups.
Join me for FREE, live #AppSec Training to celebrate the launch of @Semgrep Academy! https://t.co/g6AOW9atMi 🚀
🔒 Building an Application Security Program
June 20: Level 3
Register: https://t.co/nDbJq0wDaf
For everyone who is improving security culture, https://t.co/EMp72yBkyT might be an awesome source of inspiration for fundamental patterns that can be applied.
🤖 Building an AI AppSec Team
Using @crewAIInc to create a multi-agent AppSec team
* Code reviewer
* Exploiter
* Mitigation expert
* Report writer
#cybersecurity
https://t.co/IVzlU4VFPj
I just launched a new post with @clintgibler over on tl;drsec, check it out!
When I read Wiring the Winning Organization (@RealGeneKim, @StevenJSpear), I spent the whole time trying to map the concepts to Security
1/2
Ready to raise your #cybersecurity game? You don't want to miss Global AppSec Lisbon 2024! Join us June 24-28 for incredible training and talks in inspiring Lisbon, Portugal.
Get your tickets now at https://t.co/EThrASSBwX
We just published an almost complete list of talks that have been accepted for #TROOPERS24. Thanks to all of you who participated in the CFP! So many excellent submissions. We really had a hard time to decide which will fit best for this year!
https://t.co/QBb2cx6hdq
An underrated aspect of AppSec and Secure Coding is not exposing the insecure functionality in the first place.
Let's say you have a XML parsing library that may be used by devs wrongly/insecurely. By disabling certain functions in the library, its not vulnerable to XML Injection anymore
Instead of constantly training them to figure out security params, having a wrapper library (custom) that automatically disables insecure functionality is way more effective.
It's:
* easier to use
* easier to enforce (in SAST, CI, SBOM, etc)
* easier to train on
* reduces cognitive load for devs in the long run
* and more secure
Keep it simple.
@abhaybhargav 100%! And now expand this idea to functionality of programming languages that is dangerous to use, i.e. string concatenation. If we would be able to remove that and create an abstraction for generating output all injections would be gone.
I'm a proud sponsor of @LocoMocoSec! Please apply for the call for papers, open until March 31. Ladies and non-binary folks, this includes YOU! Everyone should apply!
https://t.co/xjcaWihjXc